Contract

Platform: HackerLab | Category: Web | Type: Challenge | Difficulty: Hard | OS: NA | Author: D3v0o0Nu11 | Date: 2026-04-08 | Status: Solved Techniques: adminer_file_read, credential_reuse, hidden_webshell_discovery, rogue_mysql_exfiltration, sudoedit_extra_file_trick

Summary

Task: a static-looking PHP pet-shop site hid Adminer 4.6.2, which could be abused for arbitrary file read through a rogue MySQL LOCAL INFILE server. Solution: exfiltrate local files to uncover a hidden webshell and admin password, then escalate via vulnerable sudoedit and read the root flag before reverting the temporary sudoers change.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: hackerlab | ID: 20260408_hackerlab_dogovor
• Tags: mysql, php, webshell, apache, arbitrary_file_read, password_reuse, privilege_escalation, adminer, local_infile, sudoedit
• Indicators: Adminer 4.6.2 exposed on a hidden path, static site with an unexpected database administration panel, target can initiate outbound MySQL connections, base64 text in shell startup files, sudo allows sudoedit on a root-owned file
• Source: 20260408_hackerlab_dogovor.md

Foothold

Vulnerability / Misconfiguration

1. Adminer_file_read
2. Credential_reuse
3. Hidden_webshell_discovery
4. Rogue_mysql_exfiltration
5. Sudoedit_extra_file_trick

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• adminer_file_read
• credential_reuse
• hidden_webshell_discovery
• rogue_mysql_exfiltration
• sudoedit_extra_file_trick
• Tags: mysql, php, webshell, apache, arbitrary_file_read, password_reuse, privilege_escalation, adminer, local_infile, sudoedit

Original Writeup

<details><summary>Click to expand original content</summary>

Description

Договор

English summary: the target looked like a simple static pet-shop website, but a hidden Adminer instance opened a path to local file disclosure. That foothold led to a hidden webshell, credential recovery, and finally a sudo-based privilege escalation to the root flag.

Recon

Initial enumeration showed a small web surface:

• 80/tcp — Apache/2.4.25
• PHP/7.2.15

The visible site pages were only static pet-shop template content, so the first useful lead came from targeted content discovery. That revealed a hidden /adminer.php endpoint running Adminer 4.6.2. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

This was the critical pivot. Adminer 4.6.2 is known to be vulnerable to arbitrary file read through the MySQL LOAD DATA LOCAL INFILE workflow when an attacker can make the target connect to a rogue MySQL server, matching the CVE-2021-43008 exploitation style.

Analysis

The public pages themselves were a dead end, but the hidden Adminer panel changed the problem from web content review to server-side trust abuse.

The intended weakness was that Adminer would connect outbound to an attacker-controlled MySQL service. By serving a rogue MySQL handshake and requesting LOCAL INFILE, it was possible to make the target upload arbitrary local files to the attacker. A local listener was not reachable from the victim, so a public VDS with TCP/3306 exposed was used as the rogue MySQL host. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

That gave a reliable arbitrary file read primitive.

The most important file discoveries were:

1. /home/admin/.bashrc
2. /home/admin/pass.txt

The first file contained base64-encoded text. After decoding it, the message was:

Sometimes we use web-shell such as fast access to the host.
For access take md5 from this message.

The MD5 had to be computed from the raw decoded message including the trailing newline, which produced:

e891b33cc5748de8c19a6f0c087a773f

That directly revealed the hidden webshell path: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

/e891b33cc5748de8c19a6f0c087a773f.php

Using the webshell to inspect the system exposed /home/admin/pass.txt, which contained the admin user password:

@dm1n3r_@lm0st_s3cur3

Solution

1. Enumerate the web service

Scan and probe the target until the hidden Adminer instance is found:

nmap -sV -p80 <target>
ffuf -u http://<target>/FUZZ -w /path/to/wordlist -fc 404

Useful findings:

• Apache 2.4.25
• PHP 7.2.15
• hidden /adminer.php

2. Abuse Adminer for arbitrary file read

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Run a rogue MySQL server on a public VDS and connect to it through Adminer. The malicious server requests local files via the LOCAL INFILE mechanism and saves the exfiltrated content.

Conceptually, the flow is:

Adminer -> connect to attacker MySQL -> rogue server requests LOCAL INFILE -> target uploads chosen local file

This was used to read /home/admin/.bashrc from the target.

3. Decode the hint and locate the hidden webshell

Decode the base64 content from .bashrc and hash the exact decoded message with its trailing newline: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

printf 'Sometimes we use web-shell such as fast access to the host.\nFor access take md5 from this message.\n' | md5

Result:

e891b33cc5748de8c19a6f0c087a773f

That identifies the webshell at:

http://<target>/e891b33cc5748de8c19a6f0c087a773f.php

4. Recover admin credentials via the webshell

Use the webshell to read the local password file:

cat /home/admin/pass.txt

Recovered credential:

admin / @dm1n3r_@lm0st_s3cur3

5. Switch to the admin user with a pseudo-TTY

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Because su expects a TTY, use script(1) to provide one and feed the password:

script -qc 'su admin -c "id && sudo -l"' /dev/null

As admin, sudo -l showed:

(root) NOPASSWD: sudoedit /etc/services

6. Exploit sudoedit for privilege escalation

The installed sudoedit was vulnerable to the extra-file trick associated with CVE-2023-22809. By abusing the editor-controlled file list, it was possible to edit an additional protected file and temporarily append this line to /etc/sudoers: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

admin ALL=(ALL:ALL) NOPASSWD:ALL

After that, root access was immediate:

sudo cat /root/flag.txt

This returned:

CODEBY{REDACTED}

The temporary sudoers modification was then removed to restore the original state. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR